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Abstract 

This  paper  considers  three  variants  of  quantum  interactive  proof  systems  in  which  short 
(meaning  logarithmic-length)  messages  are  exchanged  between  the  prover  and  verifier.  The 
first  variant  is  one  in  which  the  verifier  sends  a  short  message  to  the  prover,  and  the  prover 
responds  with  an  ordinary,  or  polynomial-length,  message;  the  second  variant  is  one  in  which 
any  number  of  messages  can  be  exchanged,  but  where  the  combined  length  of  all  the  messages 
is  logarithmic;  and  the  third  variant  is  one  in  which  the  verifier  sends  polynomially  many 
random  bits  to  the  prover,  who  responds  with  a  short  quantum  message.  We  prove  that  in 
all  of  these  cases  the  short  messages  can  be  eliminated  without  changing  the  power  of  the 
model,  so  the  first  variant  has  the  expressive  power  of  QMA  and  the  second  and  third  variants 
have  the  expressive  power  of  BQP.  These  facts  are  proved  through  the  use  of  quantum  state 
tomography,  along  with  the  finite  quantum  de  Finetti  theorem  for  the  first  variant. 


1  Introduction 

The  interactive  proof  system  model  extends  the  notion  of  efficient  proof  verification  to  an  inter¬ 
active  setting,  where  a  computationally  unrestricted  prover  tries  to  convince  a  computationally 
bounded  verifier  that  an  input  string  satisfies  a  particular  fixed  property.  They  have  been  stud¬ 
ied  extensively  in  computational  complexity  theory  since  their  introduction  roughly  25  years  ago 
[GMR85,  GMR89,  Bab85,  BM88],  and  as  a  result  much  is  known  about  them.  (See  [AB09]  and 
[Gol08],  for  instance,  for  further  discussions  of  classical  interactive  proof  systems.) 

Quantum  interactive  proof  systems  are  a  natural  quantum  computational  extension  of  the  in¬ 
teractive  proof  system  model,  where  the  prover  and  verifier  can  perform  quantum  computations 
and  exchange  quantum  information.  The  expressive  power  of  quantum  interactive  proofs  is  no 
different  from  classical  interactive  proofs:  it  holds  that  QIP  =  PSPACE  =  IP,  and  therefore  any 
problem  having  a  quantum  interactive  proof  system  also  has  a  classical  one  [JJUW09,  LFKN92, 
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Sha92],  However,  quantum  interactive  proof  systems  may  be  significantly  more  efficient  than 
classical  interactive  proofs  in  terms  of  the  number  of  messages  they  require,  as  every  problem  in 
PSPACE  has  a  quantum  interactive  proof  system  requiring  just  three  messages  to  be  exchanged 
between  a  prover  and  verifier  [KWOO].  This  is  not  possible  classically  unless  AM  =  PSPACE,  and 
this  equality  implies  the  collapse  of  the  polynomial-time  hierarchy  [BM88,  GS89]. 

In  this  paper  we  consider  quantum  interactive  proof  systems  in  which  some  of  the  messages 
are  short,  by  which  we  mean  that  the  messages  consist  of  a  number  of  qubits  that  is  logarithmic 
in  the  input  length.  Three  particular  variants  of  quantum  interactive  proofs  with  short  messages 
are  considered.  The  first  variant  is  one  in  which  the  verifier  sends  a  short  message  to  the  prover, 
and  the  prover  responds  with  an  ordinary,  or  polynomial-length,  message.  We  prove  that  this 
model  has  the  expressive  power  of  QMA.  The  second  variant  is  one  in  which  any  number  of 
messages  can  be  exchanged  between  the  prover  and  verifier,  but  where  the  combined  length  of 
all  the  messages  is  logarithmic.  We  prove  that  this  model  has  the  expressive  power  of  BQP.  The 
third  variant  is  one  in  which  the  verifier  sends  polynomially  many  random  bits  to  the  prover,  who 
responds  with  a  short  quantum  message.  We  prove  that  this  model  also  has  the  expressive  power 
of  BQP.  Thus,  in  each  of  these  three  cases,  logarithmic-length  messages  are  effectively  worthless 
and  can  be  removed  without  changing  the  power  of  the  model. 

One  possible  application  of  our  work  is  to  the  design  of  new  quantum  algorithms  or  QMA  ver¬ 
ification  procedures.  Although  we  do  not  yet  have  interesting  examples,  we  believe  it  is  possible 
that  an  intuition  about  quantum  interactive  proof  systems  with  short  messages  may  lead  to  new 
problems  being  shown  to  be  in  BQP  or  QMA,  based  on  characterizations  of  the  sort  we  prove. 

Observe  that  all  of  these  three  results  are  immediate  in  the  classical  case.  For  example,  one 
can  enumerate  all  logarithmic-length  interactions  between  a  verifier  and  prover  in  polynomial¬ 
time,  so  our  second  model,  assuming  that  the  verifier  is  classical,  has  the  expressive  power  of  P 
(or  BPP  in  the  presence  of  randomness).  This  argument,  however,  does  not  work  in  the  quantum 
case.  To  explain  the  difference  let  us  consider  the  following  simplification  of  this  model.  As¬ 
sume  that  instead  of  an  arbitrary  number  of  messages  of  logarithmic  total  length,  there  is  only  one 
logarithmic-size  message  allowed  which  is  sent  by  the  prover.  This  model  is  denoted  by  QMAiog, 
and  was  known  to  be  equal  to  BQP  [MW05].  Here  we  present  another  proof  for  this  fact  to  il¬ 
lustrate  the  main  ideas  of  the  paper.  Upon  receiving  a  logarithmic-size  message  from  the  prover, 
the  verifier  applies  a  binary  measurement  { Pacc,  Prej }  to  decide  whether  to  accept  or  reject.  Thus 
the  acceptance  probability  is  at  most  the  maximum  eigenvalue  of  Pacc.  Although  Pacc  acts  on  a 
logarithmic  number  of  qubits,  it  is  given  by  a  polynomial-size  circuit,  so  one  cannot  directly  com¬ 
pute  the  matrix  representation  of  Pacc  in  polynomial-time.  Nevertheless,  using  quantum  process 
tomography  we  can  perform  the  measurement  { PacC/  Prej }  on  polynomially  many  known  states, 
and  somehow  by  taking  the  average  of  their  outcomes  compute  an  approximation  of  Pacc.  Since 
the  matrix  representation  of  Pacc  has  only  polynomially  many  entries,  this  approximation  can  be 
arbitrarily  tight.  The  next  step  is  to  simply  find  the  maximum  eigenvalue  of  this  approximation. 

In  this  paper  instead  of  applying  quantum  process  tomography  on  a  measurement,  we  per¬ 
form  quantum  state  tomography  on  the  normalized  Choi-Jamiolkowski  representation  of  the  quan¬ 
tum  channel  corresponding  to  the  measurement.  These  two  approaches  are  equivalent,  but  the 
second  one  unifies  the  arguments  in  different  sections. 

Besides  quantum  state  tomography  and  Choi-Jamiolkowski  representation  of  quantum  chan¬ 
nels,  finite  quantum  de  Finetti  theorem  is  another  important  tool  in  this  work.  Suppose  that  we 
are  given  some  copies  of  a  state  and  we  want  to  verify  that  it  is  closed  to  some  given  state.  Us¬ 
ing  quantum  state  tomography  on  these  copies  we  can  find  an  approximation  of  the  unknown 
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state  and  solve  the  problem.  Assume  now  that  we  are  not  guaranteed  that  these  copies  are  indeed 
copies  of  the  same  state;  there  can  even  be  entanglement  among  different  copies.  To  overcome 
these  difficulties  we  use  finite  quantum  de  Finetti  theorem  to  reduce  the  problem  to  the  first  case. 

The  remainder  of  this  paper  has  the  following  organization.  Section  2  discusses  some  of  the 
background  information  needed  for  the  rest  of  the  paper,  including  background  on  the  Choi- 
Jamiolkowski  representation  of  quantum  channels,  quantum  state  tomography,  finite  quantum  de 
Finetti  theorem,  and  quantum  interactive  proof  systems.  Sections  3, 4,  and  5  then  discuss  the  three 
variants  of  quantum  interactive  proof  systems  with  short  messages  described  above. 

2  Background 

We  assume  the  reader  is  familiar  with  quantum  information  and  computation,  including  the  ba¬ 
sic  quantum  complexity  classes  BQP  and  QMA,  simple  properties  of  mixed  states,  measurements, 
channels,  and  so  on  [KSV02,  NCOO].  The  purpose  of  the  present  section  is  to  highlight  background 
knowledge  on  three  topics,  represented  by  the  three  subsections  below,  that  are  particularly  rele¬ 
vant  to  this  paper.  These  topics  are:  the  Choi-Jamiolkowski  representation  of  quantum  channels, 
quantum  state  tomography,  and  quantum  interactive  proof  systems. 

Before  discussing  these  three  topics,  it  is  appropriate  to  mention  a  few  simple  points  of  notation 
and  terminology.  Throughout  this  paper  we  let  Z  =  {0,1}  denote  the  binary  alphabet,  and  for 
each  k  G  N  we  write  C(ZA)  to  denote  the  finite-dimensional  Hilbert  space  whose  standard  basis 
vectors  are  indexed  by  Zfc  (i.e.,  the  Hilbert  space  associated  with  a  /(-qubit  quantum  register).  The 
Dirac  notation  is  used  to  describe  vectors  in  spaces  of  this  sort. 

For  a  given  space  Q  =  C(Zfc),  we  write  L  (Q)  to  denote  the  space  of  all  linear  mappings  from 
Q  to  itself,  which  is  associated  with  the  space  of  all  complex  matrices  with  rows  and  columns 
indexed  by  Z*  in  the  usual  way.  The  subsets  of  this  space  representing  the  positive  semidefinite 
operators  and  density  operators  on  Q  are  denoted  Pos  ( Q)  and  D  ( Q),  respectively.  A  standard 
inner  product  on  L  (Q)  is  defined  as  (X,  Y)  =  Tr(X*  Y)  for  all  X,  Y  6  L(Q)  (where  X*  denotes  the 
adjoint,  or  conjugate-transpose,  of  X).  The  trace  norm  of  an  operator  X  G  L  ( Q)  is  defined  as 

||  X  ||  x  =  TrVX*X, 

and  the  spectral  (or  operator)  norm  of  X  is  denoted  ||  X  || . 

2.1  Quantum  channels  and  the  Choi-Jamiolkowski  representation 

A  quantum  channel  from  a  /(-qubit  space  Q  =  C(Zfc)  to  an  /-qubit  space  7 2  =  C(Z l)  is  a  completely 
positive  and  trace-preserving  linear  mapping  of  the  form  O  :  L  (Q)  — >  L  (72).  (O  is  completely 
positive  if  O  ®  1L(5)/  f°r  every  Hilbert  space  S,  is  positive,  meaning  that  it  sends  positive  semidef¬ 
inite  operators  to  positive  semidefinite  ones.  Trance-preserving  means  that  Tr(T>(p))  =  Tr(p).) 
We  will  write  C  (Q,  72)  to  denote  the  set  of  all  such  quantum  channels.  For  any  quantum  channel 
<J>  G  C  (Q, 72)  one  defines  the  (normalized)  Choi-Jamiolkowski  representation  [Jam72,  Cho75]  of 
O  as 

p  =  i  E  <Kly><zl)®ly><zl-  (!) 

y,zeT.k 

In  other  words,  this  is  the  /  +  k  qubit  state  that  results  from  applying  O  to  one-half  of  k  pairs  of 
qubits  in  the  |</>+)  =  ( 1 00)  +  1 11) ) / y/2  state. 
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The  action  of  the  mapping  <t>  can  be  recovered  from  its  normalized  Choi-Jamiolkowski  repre¬ 
sentation  in  the  following  way  that  makes  use  of  post-selection.  Suppose  that  Q  and  Qo  are  /c-qubit 
registers  and  R  is  an  /-qubit  register,  that  the  pair  (R,  Qo)  is  initialized  to  the  state  p  as  defined  by 
<f>  in  (1),  and  that  Q  is  in  an  arbitrary  quantum  state  (and  is  possibly  entangled  with  additional 
registers  not  including  Qo  and  R).  Consider  the  following  procedure: 

1.  Measure  each  qubit  of  Q  together  with  its  corresponding  qubit  in  Qo  with  respect  to  the  Bell 
basis. 

2.  If  every  one  of  these  k  measurements  results  in  an  outcome  corresponding  to  the  Bell  state 
| cp+),  then  output  "success,"  else  output  "failure." 

This  procedure  gives  the  outcome  "success"  with  probability  4  k,  and  conditioned  on  success 
the  register  R  is  precisely  as  it  would  be  had  it  resulted  from  the  channel  T>  being  applied  to  Q.  (The 
registers  Q  and  Qo  can  safely  be  discarded  if  the  procedure  succeeds.)  To  see  this,  assume  first  that 
the  joint  state  of  (R,  Qo,  Q)  is  p  ®  £  before  the  measurement  takes  place.  Then  the  (unnormalized) 
state  of  R  after  the  measurements  are  performed,  assuming  the  end  result  is  "success,"  is 

2 L  E  ^(ly>(zl)(y1y>(zlz/>(y'l£lz/>  =  \  E  °(ly)(yl£lz)(zl)  =  ^(£>- 


The  probability  of  success  is  therefore  4  ,  and  conditioned  on  this  outcome  the  process  imple¬ 
ments  the  channel  <t>.  In  our  applications  k  is  logarithmic  in  the  size  of  the  problem,  so  T>  is 
implemented  with  an  inverse  polynomial  probability  which  is  enough  for  us.  The  fact  that  this 
process  implements  the  channel  <E>  exactly  for  all  density  operators  £  implies  that  it  also  operates 
correctly  in  the  case  that  Q  is  entangled  with  additional  registers. 

2.2  Quantum  state  tomography 

Quantum  state  tomography  is  the  process  by  which  an  approximate  description  of  an  unknown 
quantum  state  is  obtained  by  measurements  on  many  independent  copies  of  the  unknown  state. 
To  be  more  precise,  let  Q  =  C(XA)  denote  the  space  corresponding  to  a  /c-qubit  register,  and  sup¬ 
pose  that  Xi, . . . ,  X.\;  are  /c-qubit  quantum  registers  independently  prepared  in  an  unknown  /c-qubit 
state  p  G  D  (Q).  The  purpose  of  quantum  state  tomography  is  to  obtain  an  explicit  description  of 
a  /c-qubit  state  that  closely  approximates  p. 

One  way  to  perform  quantum  state  tomography  is  through  the  use  of  an  information-complete 
measurement.  A  measurement  {Pn  :  a  G  T}  on  /c-qubit  registers  is  information-complete  if  and  only 
if  the  set  {Pa  :  a  G  T}  spans  the  entire  4/l -dimensional  space  L  (Q).  When  such  a  measurement  is 
performed  on  a  /c-qubit  state  p,  each  measurement  outcome  is  obtained  with  probability 

p(a)  =  (Pa,p)  . 

Based  on  the  assumption  that  {Pa  :  a  G  T}  is  information-complete,  this  vector  p  of  probabil¬ 
ities  uniquely  determines  the  state  p.  A  close  approximation  of  p,  which  may  be  obtained  by 
sufficiently  many  independent  measurements,  leads  to  an  approximate  description  of  p. 

The  accuracy  of  an  approximation  based  on  the  process  just  described  naturally  depends  on  the 
choice  of  an  information-complete  measurement  as  well  as  the  specific  notion  of  approximation 
that  is  considered.  Our  interest  will  be  on  the  trace  distance  ||p  —  cr |L  between  the  approximation 
a  and  the  true  state  p.  To  describe  the  "quality"  of  an  information-complete  measurement,  it 
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is  appropriate  to  describe  the  specific  process  that  is  used  to  reconstruct  p  from  the  vector  of 
probabilities  p. 

For  any  spanning  set  {Pa  :  a  G  T}  of  L  (Q),  there  exists  a  set  {M„  :  a  G  F}  C  L  (Q)  that 
satisfies 

EM«  (Pa,X)  =  X 

for  every  X  G  L  (Q).  (One  may  find  such  a  set  { Ma  :  a  G  T}  by  solving  a  system  of  linear 
equations.)  The  set  { Mn  :  a  G  F}  is  uniquely  determined  when  { Pa  :  a  G  F}  has  exactly  4,c 
elements  (i.e.,  is  a  basis),  and  hereafter  we  will  restrict  our  attention  to  this  case.  Notice  that  if  p  is 
a  density  matrix,  the  coefficients  p(a)  =  {Pa,p)  form  a  probability  distribution.  If  q  is  a  probability 
vector  that  represents  an  approximation  to  p,  it  holds  that 


E  p{a)Mn  -  Y 
flgr  «er 


<  E  lp(fl)  llM«lll  <  \\p~q\\l  max|lM«Hl- 

aeT 


It  is  therefore  desirable  that  the  maximum  trace  norm  over  the  set  {Ma  :  a  G  F}  determined  by 
the  measurement  {Pa  :  a  G  F}  is  as  small  as  possible. 

There  is  one  additional  consideration  that  is  sometimes  relevant,  which  is  that  the  approxima¬ 
tion 

E'fW^ 

aeT 

may  fail  to  be  positive  semidefinite,  and  therefore  fail  to  represent  a  valid  quantum  state.  In  this 
situation  one  can  find  a  quantum  state  near  to  the  approximation  by  renormalizing  the  positive 
part  of  the  approximation.  For  the  applications  of  tomography  in  this  paper,  however,  this  issue 
may  safely  be  disregarded,  as  non-positive  approximations  of  density  operators  will  still  provide 
valid  approximations  to  the  quantities  we  are  interested  in. 

An  example  of  an  information-complete  measurement  on  a  single  qubit  is  given  by  the  follow¬ 
ing  matrices: 


Po  = 


Pi  = 


2+V2 

1+i 

8 

8 

1-i 

2-x/2 

8 

8 

2+vT 

-1-i 

8 

8 

— 1+i 

2-v/2 

,  Pi  = 


,  P3  = 


2-V2 

1-i 

8 

8 

1+i 

2+ s/2 

8 

8 

2-V2 

-1+i 

8 

8 

-1-i 

2+V2 

This  is  not  an  optimal  information-complete  measurement,  but  it  has  the  advantage  of  being  sim¬ 
ple  to  describe  and  can  be  implemented  exactly  by  a  quantum  circuit  composed  of  Hadamard, 
controlled-not,  and  n / 8-phase  gates,  and  measurement  in  the  standard  basis.  The  corresponding 
set  {Mo,  Mi,  M2,  M3}  described  above  is  given  by 


M0  = 


M2  = 


'  1+yT 

+  i 


-1  -  i 

1-V2 
2  / 


Mi  = 


'l-y/2 


1+1 


1  -  i 

1+V2 


M3  = 


'  1  — y/2 

-1-i 


-1  +  i 

1+V2 
2  / 
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It  holds  that  ||  Ma  ||a  =  \/l0  <  4  for  a  E  T  =  {0, 1,2,3}. 

An  information-complete  measurement  for  k  qubits  may  be  obtained  by  taking  tensor  products 
of  the  above  matrices.  More  specifically,  for  each  x  E  Tk,  let  us  define  2kx  2k  matrices  Px  and  Mx 
as 

Px  =  PXl  ®  ®  Pxk  and  Mx  =  MXl  <8>  ■  ■  ■  <8>  MXr 

Then  {Px  :  x  E  Tk}  is  an  information-complete  measurement,  and  its  corresponding  set  is  given 
by  { Mx  :  x  E  F/c } .  By  the  multiplicativity  of  the  trace  norm,  it  holds  that  ||  Mx  |-|  =  10/C//2  <  4k  for 
every  k. 

Now,  let  us  suppose  that  p  is  a  quantum  state  on  k  qubits,  and  tomography  (using  the  mea¬ 
surements  just  described)  is  performed  on  N  copies  of  p.  More  precisely,  the  measurement  { Px  }  is 
performed  independently  on  each  of  the  N  copies  of  p,  a  probability  distribution  q  :  Tfc  — >  [0, 1]  is 
taken  to  be  the  frequency  distribution  of  the  outcomes,  and  an  approximation 

H  = 

xeik 

to  p  is  computed.  We  require  a  bound  on  the  accuracy  of  this  approximation.  Of  course,  nothing 
can  be  said  in  the  worst  case,  as  any  sequence  of  measurement  outcomes  could  occur  with  very 
small  probability  in  general. 

Lemma  1.  For  any  choice  ofe  >  0,  taking  N  >  210k/e3  will  guarantee  that  with  probability  at  least  1  —  e, 
the  estimate  H  satisfies  ||p  —  <  e. 

Proof.  For  any  6  >  0,  and  any  fixed  choice  of  x  E  Tk,  it  follows  from  Hoeffding's  inequality  that 

Pr  [|  q{x)  —  p{x)  |  >  <5]  <  2  exp  (—2 N52)  . 


By  the  union  bound  it  follows  that 


Pr 


\q  —  p ||i  >  4 k5  <  Pr  | q(x)  —  p(x)  \  >  3  for  at  least  one  x  ETk  <  22k+1  exp  (—2 NS2)  . 


Setting  5  =  e/16c  and  using  the  inequality  e  a  <  1/a  for  all  a  >  0,  we  have 

Pr 


It  follows  that 


Ik  —  plli  >  e/4fc  <  22/c+1exp  ^—2 2k+1/e^j  <  e. 
Pr [ 1 1 p  -  H||j  >  e]  <  Pr [|| q  —  p ||x  >  e/4k]  <  e. 


□ 


The  notion  of  quantum  process  tomography  has  also  been  considered,  where  a  quantum  mea¬ 
surement  or  channel  is  approximated  through  many  independent  evaluations  of  an  appropriate 
sort  (see  for  example  [NC00]).  In  this  paper,  however,  it  is  not  necessary  to  consider  this  sort 
of  tomography  as  being  any  different  from  state  tomography.  Specifically,  we  will  approximate 
channels  (and  measurements,  modeled  as  channels)  by  evaluating  them  on  maximally  entangled 
states,  followed  by  ordinary  quantum  state  tomography  on  the  normalized  Choi-Jamiolkowski 
representations  that  result. 


6 


2.3  Finite  quantum  de  Finetti  theorem 

Suppose  that  Qi,  . . . ,  Qn  are  all  fc-qubit  registers.  A  state  on  (Qi, . . . ,  Qn)  is  called  symmetric  if  it  is 
invariant  under  any  permutation  of  its  registers.  For  instance,  any  product  state  of  the  form  p'/jN 
is  symmetric.  Any  convex  combination  of  such  states  is  symmetric  as  well.  Note,  however,  that 
there  are  symmetric  states  that  cannot  be  written  as  a  convex  combination  of  symmetric  product 
states  as  above;  as  an  example  consider  the  following  state 

l»P>  =  ~7=r  E  |*)  &••  •&!*)• 

V2,c  xeTik 

Nevertheless,  by  tracing  out  any  subsystem  of  \ip)  the  resulting  reduce  density  matrix  is  in  the 
convex  hall  of  symmetric  product  states.  The  following  theorem  generalizes  this  observation. 

Theorem  2.  (Finite  quantum  de  Finetti  theorem  [ KR05 ,  CKMR07])  Suppose  that  p^+m  is  a  symmetric 
state  over  registers  (Qi, . . . , Qn+m),  and  let  p n  =  Tr QN+v-QN+m(pN+m)-  Then  there  exist  states  and 
probability  vector  pj  such  that 


PN-EPjt?N 

i  1 


< 


* 

N  +  m 


2.4  Quantum  interactive  proofs 

Quantum  interactive  proof  systems  are  a  natural  quantum  analogue  of  ordinary,  classical  inter¬ 
active  proof  systems,  where  the  prover  and  verifier  may  process  and  exchange  quantum  infor¬ 
mation.  We  will  only  consider  quantum  interactive  proof  systems  having  an  even  number  of 
messages  in  this  paper,  so  for  simplicity  we  will  restrict  our  discussion  to  this  case. 

For  t  being  a  function  of  the  form  t  :  IN  — >  IN,  we  define  a  f-round  (or  (2f)-message)  quantum 
verifier  V  to  be  a  collection  of  quantum  circuits 

V={VXij  :  xez*,  0<j<t(\x\)}, 

which  can  be  generated  in  polynomial-time  given  x  and  j.  We  will  generally  write  t  rather  than 
f(|x|)  hereafter  in  this  paper,  keeping  in  mind  that  t  might  vary  with  the  input  length.  We  as¬ 
sume  that  the  verifier's  circuits  are  composed  of  standard  unitary  quantum  gates  (controlled-not, 
Hadamard,  and  /r/8-phase  gates,  let  us  say),  as  well  as  ancillary  and  erasure  gates.  Included 
in  the  description  of  these  circuits  is  a  specification  of  which  input  and  output  qubits  are  to  be 
considered  private  memory  qubits  and  which  are  considered  message  qubits.  The  message  qubits 
refer  to  qubits  that  are  sent  to  or  received  from  a  prover  (to  be  described  shortly).  The  following 
properties  are  required  of  the  circuits  describing  a  verifier: 

1.  For  each  x,  the  circuit  VX/o  takes  no  input  qubits,  and  the  circuit  VX/t  produces  a  single  output 
qubit  (called  the  acceptance  qubit). 

2.  There  exist  functions  V\,V2,  ■  ■  ■  such  that  VN_ \  outputs  Vj (\x\)  private  memory  qubits  and  VX/j 
inputs  Vj(\x\)  private  memory  qubits  for  !<;<*• 

3.  There  exist  functions  q\,  qi,  ■  ■  ■  and  jq,  ri, . . .  that  specify  the  number  of  message  qubits  the 
verifier  sends  to  or  receives  from  the  prover  on  each  round,  for  a  given  input  length.  More 
precisely,  each  circuit  14,/  i  outputs  qj(\x\)  message  qubits  and  each  circuit  VX/j  inputs  r, ( | x | ) 
message  qubits,  for  1  <j<t. 
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Figure  1:  An  illustration  of  an  interaction  between  a  prover  and  verifier  in  a  quantum  interactive 
proof  system.  In  the  picture  it  is  assumed  that  t  =  3.  The  labels  Vj,  pj,  Cjj  and  r;  on  the  arrows  refer 
to  the  number  of  qubits  represented  by  each  arrow. 


Similar  to  the  function  t,  we  will  often  omit  the  argument  |  x  |  from  the  functions  Vj,  Cjj,  and  r(  for 
the  sake  of  readability.  When  it  is  convenient,  we  will  refer  to  the  message  qubits  sent  from  the 
verifier  to  the  prover  as  question  qubits  and  qubits  sent  from  the  prover  to  the  verifier  as  response 
qubits. 

A  f-round  (or  (2f)-message)  prover  is  defined  in  a  similar  way  to  a  f-round  verifier,  but  no 
computational  restrictions  are  made.  Specifically,  a  f-round  prover  is  a  collection  of  quantum 
channels 

P={Px,j  :  xez*,  l<j<t(\x\)}. 

Again,  the  input  and  output  qubits  of  these  channels  are  specified  as  private  memory  qubits  or 
message  qubits.  When  a  particular  prover  P  is  considered  to  interact  with  a  given  verifier  V,  one 
naturally  assumes  that  they  agree  on  the  number  of  messages  and  the  number  of  qubits  sent  in 
each  message,  as  suggested  by  Figure  1.  But  given  the  verifier  there  is  no  restriction  on  pj,  the 
number  of  private  memory  qubits  used  by  the  prover  at  the  y'-th  round.  Although  pj  could  in 
principle  be  unbounded,  it  is  not  difficult  to  show  that  for  any  choice  of  verifier  and  prover  there 
is  another  prover  that  simulates  the  same  interaction  and  uses  at  most  a  polynomial  number  of 
private  memory  qubits  (see  [GW07]). 

Now,  on  a  given  input  string  x,  the  prover  P  and  verifier  V  have  an  interaction  by  composing 
their  circuits /channels  as  described  in  Figure  1.  The  maximum  acceptance  probability  for  a  given 
verifier  V  on  an  input  x  refers  to  the  maximum  probability  for  the  circuit  VX/t  to  output  1,  assuming 
it  is  measured  in  the  standard  basis,  over  all  choices  of  a  compatible  prover  P.  It  is  always  the  case 
that  a  maximal  probability  is  achieved  by  some  prover. 

Classes  of  promise  problems  may  be  defined  by  quantum  interactive  proof  systems  in  a  variety 
of  ways.  We  will  delay  the  definitions  of  the  classes  we  consider  to  the  individual  sections  in  which 
they  are  discussed. 

3  Two-message  quantum  interactive  proofs  with  short  questions 

The  first  specific  variant  of  quantum  interactive  proof  systems  we  consider  are  those  in  which 
just  a  single  round  of  communication  takes  place,  with  the  first  message  being  short  (at  most 
logarithmic-length)  and  the  second  message  being  normal  (at  most  polynomial-length).  In  par¬ 
ticular,  let  us  say  that  a  1-round  verifier  V  is  a  [log,  poly]  quantum  verifier  if  the  number  q  =  q  \ 
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of  question  qubits  it  sends  during  the  first  and  only  round  of  communication  satisfies  q  ( n )  = 
0(log  n ).  For  functions  of  the  form  a,  b  :  N  — >  [0, 1]  we  define  Q1P(  [log,  poly],  a,  b )  to  be  the  class 
of  all  promise  problems  B  =  ( Byes ,  Bno)  for  which  there  exists  a  [log,  poly]  quantum  verifier  V  with 
completeness  and  soundness  probability  bounds  a  and  b,  respectively.  In  other  words,  V  satisfies 
the  following  properties: 

1.  For  every  string  x  G  Byes,  there  exists  a  prover  P  compatible  with  V  that  causes  V  to  accept  x 
with  probability  at  least  a  ( |  x  | ) . 

2.  For  every  string  x  G  Bno,  and  every  prover  P  compatible  with  V ,  it  holds  that  P  causes  V  to 
accept  x  with  probability  at  most  b( |  x|). 

For  a  wide  range  of  choices  of  a  and  b,  these  classes  coincide  with  QMA  as  the  following  theorem 
states. 

Theorem  3.  Let  arb  :  N  — >•  (0,1)  be  polynomial-time  computable  functions  such  that  a(n)  —  b{n)  > 
1/ p(n)  for  some  polynomial  p.  Then  QIP(  [log,  poly],  a,  b)  =  QMA. 

Proof.  It  is  clear  that  QMA  C  QIP(  [log,  poly],  a,  b)  for  any  choice  of  a  and  b  that  satisfy  the  condi¬ 
tions  of  the  theorem,  so  our  goal  is  to  prove  the  reverse  containment. 

Let  B  =  (Byes,  Bno)  be  a  promise  problem  in  QIP( [log,  poly],  a,  b),  and  let  V  be  a  [log,  poly] 
verifier  that  witnesses  this  fact.  We  write  q  (as  above)  to  denote  the  number  of  question  qubits 
the  verifier  V  sends,  and  write  r  to  denote  the  number  of  response  qubits  V  receives.  As  V  is  a 
[log, poly]  verifier  it  holds  that  q(n)  =  0(log n).  For  a  fixed  input  x,  we  will  write  Q  =  C(EQ  to 
denote  the  question  space  and  TZ  =  <C(27)  to  denote  the  response  space  for  V,  corresponding  to  the 
question  and  response  qubits  in  the  obvious  way. 

Our  goal  is  to  prove  that  B  G  QMA,  and  to  do  this  we  will  define  a  verification  procedure  (to 
be  referred  to  as  Arthur)  that  demonstrates  this  fact.  Suppose  P  is  a  prover  that  interacts  with  V. 
For  a  fixed  input  string  x,  the  action  of  P  may  be  identified  with  a  quantum  channel  O  G  C  ( Q,  TZ), 
and  any  such  channel  defines  a  quantum  state  p  G  D  (TZ®  Q)  according  to  its  normalized  Choi- 
Jamiolkowski  representation  (1).  We  will  define  Arthur  so  that  he  expects  to  receive  many  inde¬ 
pendent  copies  of  this  state.  Fie  will  check  its  validity  using  quantum  state  tomography,  and  will 
use  the  state  to  apply  the  mapping  O  himself  through  post-selection. 

More  specifically,  we  define  Arthur  so  that  he  performs  the  following  actions: 

1.  Input  N  +  m  registers  (Ri,  Qi), . . . ,  (Rn-\  m,  Q N+m)/  where  N  and  m  are  polynomials  in  the  input 
length  n  to  be  specified  below. 

2.  Randomly  permute  the  pairs  (Ri,  Qi), . . . ,  (R N+m,  Q N+m),  according  to  a  uniformly  chosen  per¬ 
mutation  tc  G  S,v  i  m,  and  discard  all  but  the  first  N  +  1  pairs. 

3.  Perform  quantum  state  tomography  on  the  registers  (Q2, . . . ,  Qn+i)/  and  reject  if  the  resulting 
approximation  is  not  within  trace-distance  S/2  of  the  completely  mixed  state  t/2f  for  5  to  be 
specified  below. 

4.  Simulate  the  original  protocol  (P,V)  by  post-selection  using  the  register  pair  (Ri,  Qi).  Reject 
if  the  post-selection  fails,  and  otherwise  accept  or  reject  as  the  outcome  of  the  proof  system 
dictates. 

To  specify  N,  m  and  5,  we  first  set 

 1 
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for  p  being  the  polynomial  whose  reciprocal  separates  the  completeness  and  soundness  probabil¬ 
ity  bounds  a  and  b.  Now  set 


210<? 

N  = - 

(<V2)3 


and 


2N4'? 

m  = - 

e 


Given  that  q  is  logarithmic,  it  holds  that  N,  m,  1/e  and  1  /  5  are  polynomially  bounded. 

Suppose  first  that  x  G  Byes,  which  implies  that  there  exists  a  prover  P  that  causes  V  to  accept 
x  with  probability  at  least  a.  Let  <t>  denote  the  quantum  channel  that  describes  the  behavior  of  P, 
and  let  p  be  the  normalized  Choi-Jamiolkowski  representation  of  O  as  described  in  (1).  Then  for 
each  of  the  register  pairs  (Ry,  Q, )  being  prepared  independently  in  the  state  p,  it  holds  that  Arthur 
rejects  in  step  3  with  probability  at  most  S/2  (Lemma  1),  and  accepts  in  step  4  with  probability  at 
least  a/ 4?  (conditioned  on  not  having  rejected  in  step  3).  Arthur  therefore  accepts  with  probability 
at  least 


S\  a  a 

2  J  5?  >  4 ? 


Now  let  us  suppose  that  x  G  Bno.  We  first  consider  the  situation  in  which  the  state  of  the 
registers  (Qi, . . . ,  Qn+i)  at  the  beginning  of  step  3  has  the  form 


g0(N+l) 


for  some  density  operator  £  G  D  ( Q) .  There  are  two  cases  to  consider:  one  is  that  ||  £  —  1/29 1| x  <5 
and  the  other  is  that  ||  ^  —  1/29  ||x  >  5.  If  it  is  the  case  that  1 1  £  —  11  / 2‘;  1 1 ,  <  5,  then  by  the  Fuchs- 
van  de  Graaf  inequalities  [FvdG99]  there  must  exist  a  state  p  G  D  ('TZ  0  Q)  satisfying  Tr-^  (p)  = 
1/2^  that  is  within  trace  distance  e  of  the  state  of  (Ri,Qi).  To  be  more  precise,  consider  a  fixed 
purification  |  ip)  of  the  state  of  (Ri,  Qi)  with  an  auxiliary  register  E.  Since  £  =  Tr-/^ tc  (I1/’)  (V’l)  has  a 
high  fidelity  with  1/2^,  and  due  to  the  characterization  of  fidelity  in  terms  of  purifications,  there 
exists  a  purification  of  1/21?  over  ( R,  Q,  E)  that  has  a  large  overlap  with  tp).  Then  p  can  be  chosen 
as  the  reduce  density  matrix  of  this  pure  state  over  (R,  Q).  Now  given  that  x  G  Bn 0,  the  state  p 
would  cause  acceptance  in  step  4  with  probability  at  most  b/ 4?,  and  therefore  acceptance  may 
occur  in  the  case  at  hand  with  probability  at  most  b  / 4I?  +  e.  If,  on  the  other  hand,  it  holds  that 
ll£-l/2%  >  S,  then  rejection  must  occur  in  step  3  with  probability  at  least  1  —5/2,  so  Arthur 
accepts  with  probability  at  most  5/2  (which  of  course  is  smaller  than  b / 4^  +  e).  Thus,  in  both  cases, 
acceptance  occurs  with  probability  at  most  b / 4?  +  e.  It  follows  that  if  the  registers  (Qi, . . . ,  Qn+i) 
are,  at  the  beginning  of  step  3,  in  any  state  of  the  form 

EP;ff(N+I1  (2) 

i 

(i.e.,  a  convex  combination  of  states  of  the  form  just  discussed),  acceptance  may  occur  with  prob¬ 
ability  at  most  b/4f>  +  e.  Finally,  by  the  finite  quantum  de  Finetti  theorem  (Theorem  2)  it  holds 
that  the  state  of  (Qi, . . . ,  Qn+i)  after  step  2,  is  within  trace-distance  £  of  a  state  of  the  form  (2),  and 
therefore  the  probability  of  acceptance  is  at  most  b / 4“7  +  2e  in  the  general  case. 

Given  that  a/ 4/1  —  e  and  b / 4'?  +  2e  are  efficiently  computable  and  separated  by  the  reciprocal 
of  a  polynomial,  it  holds  that  B  is  in  QMA  as  claimed.  □ 
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Figure  2:  Illustration  of  a  quantum  interactive  proof  in  which  the  messages  are  single  bits. 


4  Quantum  interactive  proofs  with  only  short  messages 

Next  we  consider  quantum  interactive  proof  systems  restricted  so  that  the  total  number  of  qubits 
exchanged  by  the  prover  and  verifier  is  logarithmic.  We  prove  that  any  problem  having  such  a 
quantum  interactive  proof  system  is  contained  in  BQP.  This  fact  represents  a  significant  general¬ 
ization  of  the  equality  QMAlog  =  BQP  proved  in  [MW05].  Like  the  result  of  the  previous  section, 
our  proof  of  this  fact  is  based  on  quantum  state  tomography.  In  addition  we  will  make  use  of  the 
quantum  games  framework  of  [GW07], 

It  is  clear  that  any  quantum  interactive  proof  system  allowing  at  most  a  logarithmic  num¬ 
ber  of  qubits  to  be  exchanged  can  be  simulated  by  one  in  which  a  logarithmic  number  of  single 
qubit  messages  are  permitted,  because  any  number  of  these  messages  could  consist  of  meaning¬ 
less  "dummy"  qubits  that  are  interspersed  with  the  qubits  sent  by  the  other  party.  To  be  more 
precise,  let  t(n)  =  Oflog  n)  and  consider  a  f-round  quantum  interactive  proof  system  in  which 
each  message  consists  of  a  single  qubit  (i.e.,  q\  =  r\  =  ■  •  ■  =  qt  =  rt  =  1).  We  will  write 
QIPlogffl,  b)  to  denote  the  class  of  problems  having  quantum  interactive  proof  systems  of  this  sort 
having  completeness  and  soundness  probability  bounds  a  and  b,  respectively.  As  the  following 
theorem  states,  this  model  offers  no  computational  advantage  over  BQP. 

Theorem  4.  Let  a,  b  :  N  — >  (0,1)  be  polynomial-time  computable  functions  such  that  a(n)  —  b{n)  > 
1/ p{n)  for  some  polynomial  p.  Then  QIPiog(a,  b )  =  BQP. 

Proof.  It  is  clear  that  BQP  C  QIPlog(rt,  b),  and  so  it  remains  to  prove  the  reverse  containment.  To 
this  end  let  B  =  (Byes,  £>no)  be  a  promise  problem  in  QIPlog(a,  b),  and  let  V  be  a  verifier  that  wit¬ 
nesses  this  fact.  As  above,  let  t (n)  =  0(log  n)  denote  the  number  of  rounds  of  communication  this 
verifier  exchanges  with  any  compatible  prover.  For  a  fixed  input  string  x,  we  will  write  Q\, ...  ,Qt 
to  denote  copies  of  the  Flilbert  spaces  C(E)  associated  with  the  t  single-qubit  messages  that  V 
sends  to  a  given  prover  P,  and  we  will  write  1Z\, . . . ,  'TZt  to  denote  copies  of  the  same  space  <C(E) 
corresponding  to  the  response  qubits  of  P. 

The  action  of  V,  on  a  given  input  string  x,  is  determined  by  t  +  1  quantum  circuits  VX/o, . . . ,  Vx,t 
as  defined  in  Section  2.  Figure  2  illustrates  an  interaction  between  V  and  a  prover  P  for  the  case 
that  t  =  4.  Now  consider  the  channel  0  obtained  from  the  circuits  VX/o , . . . ,  VXft  by  setting  all 
of  the  response  qubits  the  verifier  receives  from  the  prover  as  input  qubits  and  setting  all  of  the 
question  qubits  sent  by  the  verifier  to  the  prover  as  output  qubits.  More  precisely,  0  maps  states 
on  the  space  <g>  ■  ■  ■  ®  TZt  to  states  on  the  space  A  <8>  Q\  <8>  ■  ■  ■  <8>  Qt,  where  A  denotes  the  single¬ 
qubit  space  associated  with  the  acceptance  qubit.  Figure  3  illustrates  this  channel  for  the  protocol 


11 


Figure  3:  The  channel  O  associated  with  the  quantum  interactive  proof  from  Figure  2. 


pictured  in  Figure  2. 

Next,  let 

p  =  i  E  °(ly)(zl)®  ly)(zl 

be  the  normalized  Choi-Jamiolkowski  representation  of  O.  The  state  p  is  obviously  efficiently 
preparable  given  a  description  of  V.  By  independently  preparing  N  =  2l0(2t  1 1 '  / e3  copies  of  p,  for 
£  >  0  to  be  specified  later,  and  performing  quantum  state  tomography,  one  obtains  a  Hermitian 
operator  H  on  A  <g>  1Z\  <g>  ■  •  •  <g>  IZt  Qi  •  ■  ■  <8>  Qt  that  satisfies  ||  H  —  p  <  £  with  probability  at 
least  1  —  £.  Let  us  also  define 

pi  =  «l|<g>l)p(|l)<g>1L)  and  H\  =  «l|(g>l)H(|l)<g>l) 

to  denote  the  projection  of  these  operators  on  the  subspace  in  which  the  qubit  A  is  1 1 )  (corre¬ 
sponding  to  accept). 

Using  the  terminology  of  [GW07],  pi  is  a  co-strategy  which  describes  the  verifier's  action,  and 
the  prover  optimizes  the  acceptance  probability  corresponding  to  pi  over  all  strategies.  (Strategies 
are  defined  similar  to  co-strategies  as  above  but  with  respcet  to  the  prover 's  action.)  Given  any 
strategy  X  of  the  prover,  the  acceptance  probability  is  proportional  to  the  inner  product  of  pi  and 
X.  More  precisely,  the  maximum  acceptance  probability  is  equal  to 

maximize:  2f(pi,X) 
subject  to:  X  G  St 

where  St  C  Pos  (TZi  <g>  ■  ■  ■  <S>  TZt  <S>  Qi  <8>  ■  ■  ■  ®  Qt )  U  the  space  of  all  strategies.  It  is  shown  in  [GW07] 
that  St  is  characterizes  as  5o  =  1  and 

Sj  =  {x>  0  :  Tr-ft.  (X)  =  Y  ®  tQjl  Y  G  SM} 

for  j  >  1.  This  characterization  of  St  turns  the  above  optimization  problem  to  a  semidefinite 
program.  So  we  just  need  to  replace  pi  with  its  approximation  H  j . 

It  is  clear  that  Tr(X)  =  21  for  every  X  G  St,  and  therefore 

|2f  (plrX)  -  2f  (HlrX)  |  <  2l  ||X||  ||p!  -  Hi  ||x  <  ||Pl  -  H,  ||x  <  ||p  -  H\\t 
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for  every  X  G  Sf.  By  taking 


1 


4  t+1p 

for  instance,  one  may  therefore  distinguish  the  cases  x  G  £>yes  and  x  G  Bn 0  with  probability  1  —  e, 
by  solving  the  semidefinite  program  described  above.  (Semidefinite  programs  can  be  efficiently 
solved  up  to  an  inverse  polynomial  accuracy.)  □ 

We  note  that  precisely  the  same  argument  allows  one  to  conclude  that  quantum  refereed  games, 
as  defined  in  [GW07],  allowing  for  at  most  a  logarithmic  number  of  qubits  of  communication 
offer  no  computational  power  beyond  BQP.  In  other  words,  QRG|og  =  BQP,  for  QRGiog  defined 
appropriately.  The  details  are  left  to  the  reader. 

5  Two-message  quantum  interactive  proofs  with  short  answers 

In  light  of  the  results  of  Section  3,  one  may  ask  if  two-message  quantum  interactive  proofs  with 
short  answers  (as  opposed  to  short  questions )  have  the  power  of  QMA  or  even  BQP.  If  this  is  true 
it  is  likely  to  be  difficult  to  show:  the  graph  non-isomorphism  problem,  which  is  not  known  to  be 
in  QMA,  has  a  simple  and  well-known  classical  protocol  [GMW91]  requiring  polynomial-length 
questions  and  constant-length  answers.  (Indeed,  every  problem  in  QSZK  has  a  two-message 
quantum  interactive  proof  system  with  a  constant-length  message  from  the  prover  to  the  verifier, 
for  any  choice  of  constant  completeness  and  soundness  errors  [Wat02].) 

We  can  show,  however,  that  public-coin  quantum  interactive  proofs  in  which  the  verifier  sends 
polynomially  many  random  bits  to  the  prover,  followed  by  a  logarithmic-length  quantum  message 
response  from  the  prover,  have  only  the  power  of  BQP. 

Following  a  similar  terminology  to  the  classical  case,  we  refer  to  a  quantum  interactive  proof 
system  in  which  the  verifier's  messages  to  the  prover  consist  of  uniformly-generated  random  bits 
as  quantum  Arthur-Merlin  games.  Let  us  write  QAM(  [poly,  log],  a,  b )  to  denote  the  class  of  promise 
problems  having  two-message  quantum  Arthur-Merlin  games  with  completeness  and  soundness 
probability  bounds  a  and  b,  in  which  Merlin's  response  to  Arthur  has  logarithmic  length. 

Theorem  5.  Let  a,b  :  N  — >•  (0,1)  be  polynomial-time  computable  functions  such  that  a(n )  —  b(n)  > 
l/p(n)  for  some  polynomial-bounded  function  p.  Then  QAM([poly,log],a,  b)  =  BQP. 

Proof.  Assume  that  B  is  a  promise  problem  in  QAM  ([poly,  log],fl,  b),  and  consider  a  choice  of 
Arthur  that  witnesses  this  fact.  For  r(n)  =  0(log  n),  and  for  any  choice  of  an  input  string  x,  Arthur 
chooses  a  random  string  y  with  length  polynomial  in  |  x  |,  and  then  measures  r  =  r  ( |  x  \ )  qubits  sent 
by  Merlin  with  respect  to  some  binary-valued  measurement  {Pq'J  ,  Pj ,y}  that  depends  on  x  and  y. 
Thus,  assuming  that  the  randomly  chosen  string  is  y,  the  maximum  acceptance  probability  of 
Arthur  is  equal  to  the  spectral  norm  of  P*'y.  So  to  find  Pfl/  (and  its  norm)  we  perform  quantum 
state  tomography  on  the  normalized  Choi-Jamiolkowski  representation  of  the  channel 

<E =  (Po'V)  1 0) <0 1  +  <P*'V>  |1)<1|, 

which  describes  Arthur's  measurement. 

The  following  algorithm  shows  that  B  G  BQP. 

1.  Choose  y  uniformly  at  random  (just  as  Arthur  does). 
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2.  Let 


1 


2  r+3p 


2l0(r+l) 

and  N  = - ~ — 

eJ 


Prepare  N  copies  of  the  state  p,  defined  to  be  the  normalized  Choi-Jamiolkowski  representa¬ 
tion  of  0X/y,  and  perform  quantum  state  tomography  of  p.  Let  H  denote  the  result.  Then  by 
Lemma  1  with  probability  at  least  1  —  e,  \\p  —  <  e. 


3.  Compute  the  value 


«y  =  2r  II  ((1|®1)H(|1)  ®1)|| . 


It  can  easily  be  shown  that  tty  is  an  approximation  of  1 1  Pfy  1 1 .  If  «y  >1  then  accept.  Otherwise, 
accept  with  probability  tty  and  reject  otherwise. 


Since  the  maximum  acceptance  probability  of  Arthur  is  equal  to  the  expectation  value  of  1 1  Pfy  1 1 
over  the  random  choice  of  y,  and  with  probability  1  —  e,  tty  is  within  distance  2re  of  |  Pfy  ||,  the 
above  procedure  has  acceptance  probability  within  1/  (4p)  of  the  maximum  acceptance  probabil¬ 
ity  of  Arthur.  Therefore  B  E  BQP.  □ 


6  Open  problems 

Besides  the  open  problems  mentioned  above,  the  following  two  questions  have  been  raised  by 
unknown  referees  which  we  leave  for  future  works.  The  first  one  is  to  find  the  expressive  power 
of  the  following  model:  the  verifier  and  prover  send  messages  to  each  other  with  the  total  number 
of  0(log  n)  qubits  and  at  the  end  the  prover  sends  a  polynomial-size  message  to  the  verifier.  This 
model  contains  QMA  and  it  seems  that  combining  the  ideas  in  Sections  3  and  4  the  other  direction 
can  also  be  proved.  The  other  model  is  an  interactive  protocol  in  which  the  verifier  always  sends 
public-coin  messages  to  the  prover  of  the  total  polynomial-length  and  the  prover  replies  with 
qubits  of  the  total  logarithmic-length. 
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